Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1521038

[PATCH 3.2 066/152] arm: oabi compat: add missing access checks

From Ben Hutchings <ben@decadent.org.uk>
Newsgroups linux.kernel
Subject [PATCH 3.2 066/152] arm: oabi compat: add missing access checks
Date 2016-11-14 04:10 +0100
Message-ID <sDfOI-11Z-83@gated-at.bofh.it> (permalink)
References <sDeSC-o3-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


3.2.84-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Weinstein <olorin@google.com>

commit 7de249964f5578e67b99699c5f0b405738d820a2 upstream.

Add access checks to sys_oabi_epoll_wait() and sys_oabi_semtimedop().
This fixes CVE-2016-3857, a local privilege escalation under
CONFIG_OABI_COMPAT.

Reported-by: Chiachih Wu <wuchiachih@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Dave Weinstein <olorin@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/arm/kernel/sys_oabi-compat.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -275,8 +275,12 @@ asmlinkage long sys_oabi_epoll_wait(int
 	mm_segment_t fs;
 	long ret, err, i;
 
-	if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event)))
+	if (maxevents <= 0 ||
+			maxevents > (INT_MAX/sizeof(*kbuf)) ||
+			maxevents > (INT_MAX/sizeof(*events)))
 		return -EINVAL;
+	if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
+		return -EFAULT;
 	kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
 	if (!kbuf)
 		return -ENOMEM;
@@ -313,6 +317,8 @@ asmlinkage long sys_oabi_semtimedop(int
 
 	if (nsops < 1 || nsops > SEMOPM)
 		return -EINVAL;
+	if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
+		return -EFAULT;
 	sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
 	if (!sops)
 		return -ENOMEM;

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 3.2 000/152] 3.2.84-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 070/152] cdc-acm: fix wrong pipe type on rx interrupt  xfers Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 108/152] frv: fix clear_user() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 088/152] ALSA: timer: fix NULL pointer dereference on  memory allocation failure Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 044/152] KEYS: 64-bit MIPS needs to use  compat_sys_keyctl for 32-bit userspace Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 009/152] ext4: check for extents that wrap around Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
    Re: [PATCH 3.2 009/152] ext4: check for extents that wrap around Vegard Nossum <vegard.nossum@oracle.com> - 2016-11-14 16:40 +0100
      Re: [PATCH 3.2 009/152] ext4: check for extents that wrap around Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 17:20 +0100
  [PATCH 3.2 101/152] asm-generic: make copy_from_user() zero the  destination properly Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 077/152] USB: serial: option: add WeTelecom WM-D200 Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 125/152] microblaze: fix __get_user() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 010/152] ext4: don't call ext4_should_journal_data()  on the journal inode Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 041/152] l2tp: Correctly return -EBADF from  pppol2tp_getname. Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 089/152] ALSA: timer: fix NULL pointer dereference in  read()/ioctl() race Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 045/152] drm/radeon: fix firmware info version checks Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 053/152] dm flakey: error READ bios during the  down_interval Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 030/152] crypto: scatterwalk - Fix test in  scatterwalk_done Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 131/152] openrisc: fix the fix of copy_from_user() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 066/152] arm: oabi compat: add missing access checks Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 112/152] mn10300: copy_from_user() should zero on  access_ok() failure... Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 037/152] nfs: don't create zero-length requests Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:10 +0100
  [PATCH 3.2 015/152] x86/quirks: Apply nvidia_bugs quirk only on  root bus Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 013/152] ALSA: ctl: Stop notification after disconnection Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 019/152] NFS: Don't drop CB requests with invalid  principals Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 007/152] usb: renesas_usbhs: protect the CFIFOSEL  setting in usbhsg_ep_enable() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 021/152] Bluetooth: Add support of 13d3:3490 AR3012 device Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 003/152] sched/cputime: Fix prev steal time accouting  during CPU hotplug Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 029/152] Bluetooth: Fix l2cap_sock_setsockopt() with  optname BT_RCVMTU Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 008/152] Input: xpad - validate USB endpoint count  during probe Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 036/152] MIPS: RM7000: Double locking bug in  rm7k_tc_disable() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 018/152] svc: Avoid garbage replies when pc_func()  returns rpc_drop_reply Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 006/152] usb: renesas_usbhs: fix NULL pointer  dereference in xfer_work() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 035/152] tty/vt/keyboard: fix OOB access in  do_compute_shiftstate() Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  [PATCH 3.2 012/152] drm/radeon: Poll for both connect/disconnect  on analog connectors Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 04:20 +0100
  Re: [PATCH 3.2 000/152] 3.2.84-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-11-14 06:50 +0100
    Re: [PATCH 3.2 000/152] 3.2.84-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-11-14 18:20 +0100

csiph-web